ESXi Firewall rule for IPFIX(port 2055) gets disabled on ESXi 6.7 post reboot / netcpa process restart

Products

• VMware NSX

Issue/Introduction

Symptoms:
1. When IPFIX is enabled from (NSX/vRNI), IPFIX packets are not received by the collector.
2. If an ESXi host reboots, the IPFIX packets are not received by the collector.
3. if netcpa process on ESXi host is restarted, IPFIX packets are not received by the collector.

How to Identify the problem:
Initiate a packet capture on the uplink vmnic interface (vmnic x) of source ESXi host from where the IPFIX packets are generated using the example below.

Example:
pktcap-uw --switchport 50331650 --dir 1 --stage 1 -o -| tcpdump-uw -ner - -n -t port 2055
 
Will see 0(zero) packets for IPFIX traffic for the above packet capture.
 
To find the switch port number
[root@localhost:~] net-stats -l
PortNum          Type SubType SwitchName       MACAddress         ClientName
33554434            4       0 vSwitch0         00:50:56:01:18:b3  vmnic0
33554436            3       0 vSwitch0         00:50:56:01:18:b3  vmk0
50331650            4       0 vSwitch1         00:50:56:01:18:b4  vmnic1    <------------- Considering this uplink is used for vRNI traffic
50331652            3       0 vSwitch1         00:50:56:68:a9:32  vmk1

Environment

VMware NSX-T Data Center 2.x
VMware NSX-T Data Center

Cause

After the ESXi host reboot / netcpa process restart the IPFIX firewall rule in the ESXi host gets automatically disabled. This blocks IPFIX pakcets at source ESXi host level.

Resolution

This is a known issue currently affecting ESXi 6.7 release and currently there is no resolution.

Workaround:
Enable IPFIX firewall rule on ESXi host from Web Client UI

1. Login to UI of ESXi
2. Navigate to networking tab on the left pane
3. Navigate to Firewall rules tab on the right pane
4. Identify the ipfix firewall rule from the displayed rules and go to action and enable the same.